Privacy Notice

1.1 Hein Wagner Academy NPC (“the Academy”) is an educational non-profit organisation providing specialised training, skills development and hosting facilities for visually impaired and other learners.

1.2 Section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”) requires the Academy, when it collects personal information, to make you aware of what is collected and from where, who we are, why we collect it, whether you are obliged to supply it and what happens if you do not, any law requiring the collection, whether the information is transferred outside South Africa, who receives it, and what your rights are. This notice gives that information in one place.

1.3 This notice does not create rights beyond those conferred by POPIA and does not replace the Academy’s manual published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (“PAIA”), which is available on the Academy’s website.

2.1 The responsible party is Hein Wagner Academy NPC, a non-profit company incorporated under the laws of the Republic of South Africa with registration number 2019/025161/08.

2.2 Physical and postal address: 20 Adderley Street, Worcester, 6850, Western Cape, South Africa.

2.3 Telephone: 023 346 6800. Email: [email protected].

2.4 The Academy has designated an Information Officer, registered with the Information Regulator, who is responsible for the Academy’s compliance with POPIA and PAIA. All enquiries about this notice and all requests to exercise the rights set out in clause 10 must be addressed to the Information Officer at [email protected], marked for the attention of the Information Officer.

3.1 The Academy collects personal information in the following categories. These categories are not a closed list; where the Academy processes information falling outside them, it does so only for a specific, defined and lawful purpose:

3.2 Most of this information is collected directly from you, through application, enrolment, intake, employment, donation and website processes and through your correspondence with the Academy.

3.3 Where information is not collected directly from you, it is obtained from a parent, guardian or other competent person acting for a learner under the age of 18; from referees or previous employers you have nominated; from a medical or diagnostic practitioner whose assessment you have provided or consented to; or from partner institutions, funders and sponsors in respect of learners they place or fund with the Academy.

3.4 Learner medical files, disability assessments and visual impairment diagnostic records are special personal information as defined in section 26 of POPIA. The Academy processes this information under the authorisations in section 27, on the basis of the consent of the data subject or of a competent person, and in order to secure the disability benefits, funding and support to which a learner is entitled.

4.1 The Academy collects personal information for explicit, defined and lawful educational and administrative purposes, and does not process it further in a manner incompatible with the purpose of collection.

4.2 For TVET programme students, the purposes are performance of the training contract, educational administration and compliance with partnership agreements with the partner college.

4.3 For Cyber Security programme students, the purposes are educational administration and sponsorship administration and reporting.

4.4 For staff members, contractors and job applicants, the purposes are recruitment, performance of the employment contract, payroll administration and compliance with employment and tax legislation.

4.5 For donors, the purposes are non-profit governance, financial reporting, the issuing of tax certificates in terms of section 18A of the Income Tax Act 58 of 1962, and donor communication.

4.6 For hostel residents, the purposes are accommodation management, safety and health protocols.

4.7 For learners with a visual impairment or other disability, an additional purpose is to secure the disability benefits, funding and support to which the learner is entitled.

4.8 For website visitors and enquirers, the purposes are responding to your enquiry, processing donations, publishing reviews you submit, and maintaining the security and integrity of the website.

4.9 The Academy relies on the grounds for lawful processing in section 11 of POPIA, namely performance of a contract, compliance with a legal obligation, the legitimate interests of the Academy or of a data subject, and consent. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, or information the Academy is required by law to retain.

5.1 Some of the information described in clause 3 is mandatory, because the Academy cannot perform its obligations or comply with the law without it. This includes identity and contact details for enrolment, the information required by funders and partner institutions, and the identity, tax and banking information required for employment and payroll.

5.2 If mandatory information is not supplied, the Academy may be unable to process an application, enrol a learner, allocate accommodation, conclude or administer an employment contract, issue a section 18A tax certificate, or secure a disability benefit on a learner’s behalf.

5.3 The remainder of the information is supplied voluntarily. Declining to supply voluntary information has no consequence beyond the Academy being unable to provide the specific service to which that information relates. Information submitted through the website is supplied voluntarily, save that the Academy cannot respond to an enquiry or process a donation without the details required for that purpose.

5.4 At the point of collection, the Academy will indicate which information is mandatory.

6.1 Certain information is collected because legislation requires or authorises it. The principal statutes are the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Income Tax Act 58 of 1962 and other legislation administered by the South African Revenue Service, the Companies Act 71 of 2008, and the legislation and funding rules governing the Academy’s accredited training and non-profit reporting obligations.

7.1 The Academy does not sell personal information and does not share it other than as set out below or as required by law.

7.2 In respect of TVET programme students, information is shared with the National Student Financial Aid Scheme, the partner college through which the programme is delivered, and the Department of Higher Education and Training, for educational administration and the processing of student disability benefits.

7.3 In respect of Cyber Security programme students, information is shared with the corporate sponsor of the programme, the relevant professional body, and the relevant Sector Education and Training Authorities, for sponsorship administration and the processing of student disability benefits.

7.4 In respect of staff members and contractors, information is shared with the South African Revenue Service, statutory funds, and the Academy’s payroll and accounting service providers, as required for employment administration and statutory compliance.

7.5 In respect of donors, information is shared with the Academy’s auditors and payment service providers, and with the South African Revenue Service where a section 18A certificate is issued.

7.6 In respect of website visitors, information is shared with the Academy’s website hosting, content delivery, security and payment service providers to the extent necessary to operate the website and process donations.

7.7 The Academy also uses operators, including cloud service providers, that process personal information on its behalf under written mandate. Operators may process personal information only on the Academy’s instructions and are required to maintain appropriate confidentiality and security measures.

7.8 Special personal information is not disclosed to any recipient other than those identified above without the prior written authorisation of the Information Officer or the consent of the data subject or a competent person.

8.1 The Academy uses established international cloud, hosting and payment services, and corresponds with international donors, foreign educational partners and global sponsors. Personal information may accordingly be stored or processed outside the Republic of South Africa.

8.2 In terms of section 72 of POPIA, the Academy transfers personal information to a recipient in a foreign country only where that recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to the conditions for lawful processing under POPIA, or where another ground in section 72 applies.

8.3 Where personal information is processed in the European Economic Area, it enjoys the protection of the General Data Protection Regulation (EU) 2016/679, which meets and exceeds the adequacy standard required by section 72.

9.1 In terms of section 14 of POPIA, the Academy retains personal information only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as a law, contract or legitimate operational requirement obliges it to do so.

9.2 Employee records are retained for the duration of employment and for a further three years thereafter. Donor records are retained for the duration of the active relationship and for a further five years thereafter. Financial and tax records are retained for the periods prescribed by tax and companies legislation.

9.3 Learner and alumni records are retained on a longer-term basis. Many of the Academy’s learners have no reliable personal storage for original documentation, and the Academy therefore acts as custodian of copies of their certificates and qualifications so that these can be reissued to them on request. A learner or alumnus may ask the Information Officer to destroy the copies held on their behalf.

9.4 When a retention period ends, records are securely destroyed or de-identified.

9.5 In terms of section 19 of POPIA, the Academy maintains appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of the personal information in its possession, and to prevent its loss, damage, unauthorised destruction or unlawful access. Operators acting on the Academy’s behalf are required to maintain equivalent measures.

9.6 Where there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, the Academy will notify the Information Regulator and will notify you as required by section 22 of POPIA, providing sufficient information to allow you to take protective measures.

10.1 As a data subject you have the right:

1. 10.1.1 to be notified that your personal information is being collected, and that it has been accessed or acquired by an unauthorised person;
2. 10.1.2 to request confirmation, free of charge, of whether the Academy holds personal information about you, and to request the record or a description of it (sections 23 and 25);
3. 10.1.3 to request the correction, destruction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, and of information the Academy is no longer authorised to retain (section 24);
4. 10.1.4 to object, on reasonable grounds, to the processing of your personal information (section 11(3)(a));
5. 10.1.5 to object at any time to the processing of your personal information for purposes of direct marketing (section 11(3)(b));
6. 10.1.6 not to be subject to a decision that results in legal consequences for you, or affects you to a substantial degree, based solely on the automated processing of your personal information (section 71); and
7. 10.1.7 to submit a complaint to the Information Regulator, and to institute civil proceedings, in respect of an alleged contravention of POPIA (sections 74 and 99).

10.2 The Academy does not currently conduct electronic direct marketing. Should it do so in future, it will comply with section 69 of POPIA, sending electronic direct marketing only to a person who has consented to receive it or to an existing donor or customer in respect of similar offerings, and providing a functioning means of opting out at no cost in every such communication.

11.1 A request for access to personal information must be made on Form 2 of the Regulations Relating to the Protection of Personal Information, 2018, and a request for correction or deletion on Form 3. Both forms are available from the Academy on request and on the website of the Information Regulator.

11.2 Completed forms must be emailed to [email protected] for the attention of the Information Officer, or delivered to the Academy at the address in clause 2.

11.3 The Academy may require proof of identity before acting on a request, in order to protect your information from disclosure to an unauthorised person.

11.4 The Academy will respond within a reasonable time. A request for access to a record other than your own personal information is dealt with under PAIA in accordance with the Academy’s PAIA manual, and a prescribed fee may be payable in the circumstances set out in that manual.

11.5 If the Academy corrects, destroys or deletes information, or refuses a request, it will notify you of the outcome and of your right to complain to the Information Regulator. Where corrected information has previously been supplied to a third party who is still using it, the Academy will, where reasonably practicable, inform that third party of the correction.

12.1 Please raise any concern with the Academy first, at [email protected]. If you are not satisfied, you may lodge a complaint with the Information Regulator in terms of section 74 of POPIA, on the prescribed Form 5 or through the Regulator’s eServices portal.

13.1 The Academy reviews this notice at least annually, and sooner where the law, the Academy’s processing activities or its systems change materially.

13.2 The current version and its effective date appear at the top of this notice. A revised version takes effect on publication on the Academy’s website.